> Markdown version of [/jobs/ext/3665613-incident-response-analysts](https://www.wearedevelopers.com/jobs/ext/3665613-incident-response-analysts). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Incident Response Analysts

- **Company:** Nabout Leidos
- **Location:** Alexandria, VA, United States
- **Experience:** Experienced
- **Salary:** $87,100.0 - $157,450.0
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Email Filtering, Intrusion Detection Systems, Security Information and Event Management, EndPointSecurity, Firewalls (Computer Science), Cyber Warfare
- **Published:** October 10, 2026
- **Apply:** https://jobs.military.com/career/362121/incident-response-analyst-virginia-va-alexandria

## About the Role

* Bachelor's degree and 4 or more years of relevant cybersecurity experience.\n
 * Experience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation.\n
 * Experience performing analysis of cybersecurity events and determining appropriate response or escalation actions.\n
 * Experience supporting incident containment, eradication, recovery, and post-incident activities.\n
 * Experience monitoring and analyzing enterprise cybersecurity tools and security telemetry.\n
 * Experience documenting incident timelines, investigative findings, evidence, response actions, and status.\n
 * Experience coordinating cybersecurity incidents across technical teams and stakeholder organizations.\n
 * Working knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts.\n
 * Ability to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats.\n
 * Ability to communicate clearly during active cybersecurity incidents and maintain accurate documentation under time-sensitive conditions.\n
 * Ability to support after-hours incident response and the required one-hour recall when assigned.\n
 * U.S. Citizenship required.\n
 * Active Secret security clearance required.\n, * Experience supporting cybersecurity incident response within Department of Defense or Federal environments.\n
 * Experience responding to incidents in both unclassified and classified network environments.\n
 * Experience with Security Information and Event Management platforms and enterprise security-monitoring capabilities.\n
 * Experience analyzing endpoint-security, firewall, Intrusion Detection System, Intrusion Prevention System, web-security, antispam, or malware-prevention data.\n
 * Experience supporting evidence collection and preservation during cybersecurity investigations.\n
 * Experience coordinating incident response with Security Operations Center personnel, Cybersecurity Service Providers, system owners, network teams, and other technical organizations.\n
 * Experience operating in a 24x7 cybersecurity operations environment or supporting after-hours incident response.\n
 * Familiarity with Department of Defense cybersecurity incident-response processes and requirements.\n
 * Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.\n

## Description

* Recognize potential intrusion attempts, malicious activity, or other cybersecurity conditions requiring immediate investigation or mitigation.\n
 * Assess cybersecurity events to determine scope, potential impact, affected systems, and required response actions.\n
 * Support containment and mitigation of active cybersecurity threats in accordance with approved Government procedures.\n
 * Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and other technical stakeholders.\n
 * Collect and preserve technical evidence associated with cybersecurity events and incidents.\n
 * Maintain complete and accurate incident records, timelines, supporting evidence, investigative findings, response actions, and status information.\n
 * Develop and contribute to required cybersecurity event and incident reporting.\n
 * Coordinate incident-response activities with Security Operations Center analysts, Cybersecurity Service Providers (CSSPs), system owners, technical teams, and Government stakeholders.\n
 * Support escalation of significant cybersecurity events and incidents in accordance with established procedures.\n
 * Provide timely status updates during active investigations and incident-response activities.\n
 * Support post-incident analysis and lessons learned to identify opportunities to improve monitoring, detection, response procedures, and defensive capabilities.\n
 * Participate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement.\n